hosts/rpi4/authelia.nix

@@ -1,31 +1,18 @@
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 let
-  inherit (lib) types mkIf optionalString;
+  inherit (lib) types
+    mkIf
+    optionalString;
   inherit (builtins) isNull any attrValues;
 
-  validAuthMethods = [
+  getUpstreamFromInstance = instance: let
-    "normal"
-    "basic"
-  ];
-  getUpstreamFromInstance =
-    instance:
-    let
     inherit (config.services.authelia.instances.${instance}.settings) server;
     inherit (server) port;
-      host =
+    host = if server.host == "0.0.0.0" then "127.0.0.1"
-        if server.host == "0.0.0.0" then
-          "127.0.0.1"
       else if lib.hasInfix ":" server.host then
         throw "TODO IPv6 not supported in Authelia server address (hard to parse, can't tell if it is [::])."
-        else
+      else server.host;
-          server.host;
+  in "http://${host}:${port}";
-    in
-    "http://${host}:${port}";
 
   # use this when reverse proxying to authelia (and only authelia because i
   # like the nixos recommended proxy settings better)
@@ -42,8 +29,7 @@ let
 
     ## Basic Proxy Configuration
     client_body_buffer_size 128k;
-    # Timeout if the real server is dead.
+    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; ## Timeout if the real server is dead.
-    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
     proxy_redirect  http://  $scheme://;
     proxy_http_version 1.1;
     proxy_cache_bypass $cookie_session;
@@ -67,6 +53,7 @@ let
     proxy_connect_timeout 360;
   '';
 
+
   autheliaLocation = ''
     internal;
 
@@ -106,62 +93,17 @@ let
     proxy_set_header X-Forwarded-URI $request_uri;
   '';
 
-  genAuthConfig =
-    method:
-    let
-      snippet_regular = ''
-        ## Configure the redirection when the authz failure occurs. Lines starting
-        ## with 'Modern Method' and 'Legacy Method' should be commented /
-        ## uncommented as pairs. The modern method uses the session cookies
-        ## configuration's authelia_url value to determine the redirection URL here.
-        ## It's much simpler and compatible with the mutli-cookie domain easily.
-
-        ## Modern Method: Set the $redirection_url to the Location header of the
-        ## response to the Authz endpoint.
-        auth_request_set $redirection_url $upstream_http_location;
-
-        ## Modern Method: When there is a 401 response code from the authz endpoint
-        ## redirect to the $redirection_url.
-        error_page 401 =302 $redirection_url;
-      '';
-    in
-    ''
-      ## Send a subrequest to Authelia to verify if the user is authenticated and
-      # has permission to access the resource.
-
-      auth_request /internal/authelia/authz${optionalString method == "basic" "/basic"};
-
-      ## Save the upstream metadata response headers from Authelia to variables.
-      auth_request_set $user $upstream_http_remote_user;
-      auth_request_set $groups $upstream_http_remote_groups;
-      auth_request_set $name $upstream_http_remote_name;
-      auth_request_set $email $upstream_http_remote_email;
-
-      ## Inject the metadata response headers from the variables into the request
-      ## made to the backend.
-      proxy_set_header Remote-User $user;
-      proxy_set_header Remote-Groups $groups;
-      proxy_set_header Remote-Name $name;
-      proxy_set_header Remote-Email $email;
-
-      ${optionalString method == "regular" snippet_regular}
-    '';
-  genAuthConfigPkg =
-    method: pkgs.writeText "authelia-authrequest-${method}.conf" (genAuthConfig method);
 in
 {
   # authelia
-  options.services.nginx =
+  options.services.nginx = let
-    let
     mkAttrsOfSubmoduleOpt = module: lib.mkOption { type = with types; attrsOf (submodule module); };
 
     # make system config accessible from submodules
     systemConfig = config;
 
     # submodule definitions
-      vhostModule =
+    vhostModule = { name, config, ... }@attrs: {
-        { name, config, ... }@attrs:
-        {
       options = {
         locations = mkAttrsOfSubmoduleOpt (locationModule' attrs);
         authelia = {
@@ -200,33 +142,18 @@ in
               endpoint URL.
             '';
           };
-              method = lib.mkOption {
-                description = ''
-                  Default Authelia authentication method to use for all locations
-                  in this virtualHost. Authentication is disabled by default for
-                  all locations if this is set to `null`.
-                '';
-                type = with types; nullOr oneOf validAuthMethods;
-                default = "regular";
-                example = "basic";
-              };
         };
       };
       config = {
-            authelia.upstream = mkIf (!(isNull config.authelia.instance)) (
+        authelia.upstream = mkIf (!(isNull config.authelia.instance))
-              getUpstreamFromInstance config.authelia.instance
+          (getUpstreamFromInstance config.authelia.instance);
-            );
+        authelia.endpoint.upstream = mkIf (!(isNull config.authelia.endpoint.instance))
-            authelia.endpoint.upstream = mkIf (!(isNull config.authelia.endpoint.instance)) (
+          (getUpstreamFromInstance config.authelia.endpoint.instance);
-              getUpstreamFromInstance config.authelia.endpoint.instance
-            );
 
         # authelia nginx internal endpoints
-            locations =
+        locations = let
-              let
           api = "${config.authelia.upstream}/api/authz/auth-request";
-              in
+        in lib.mkIf (!(isNull config.authelia.upstream)) {
-              lib.mkIf (!(isNull config.authelia.upstream)) {
-                # just setup both, they can't be accessed externally anyways.
           "/internal/authelia/authz" = {
             proxyPass = api;
             recommendedProxyConfig = false;
@@ -245,35 +172,12 @@ in
       };
     };
 
-      locationModule' =
+    locationModule' = vhostAttrs: { name, config, ... }: let
-        vhostAttrs:
-        { name, config, ... }:
-        let
       vhostConfig = vhostAttrs.config;
-        in
+    in {
-        {
-          options.authelia.method = lib.mkOption {
-            description = ''
-              Authelia authentication method to use for this location.
-              Authentication is disabled for this location if this is set to
-              `null`.
-            '';
-            type = with types; nullOr oneOf validAuthMethods;
-            default = vhostConfig.authelia.method;
-            example = "basic";
-          };
-          config =
-            lib.mkIf (!(lib.strings.hasPrefix "/internal/authelia/" name))
-            && (!(isNull vhostConfig.authelia.upstream))
-            && (!(isNull config.authelia.method)) {
-              extraConfig = ''
-                include ${genAuthConfigPkg config.authelia.method};
-              '';
-            };
     };
 
-    in
+  in {
-    {
     virtualHosts = mkAttrsOfSubmoduleOpt vhostModule;
   };